Read This First 




Introducing Symantec 
pcAnywhere 10.5 

Symantec pcAnywhere lets you remotely connect to 
another computer, open any file or program that 
you have permission to access, and work as though 
you are sitting at that computer. 

This guide is a supplement to the pcAnywhere 
User's and Administrator's Guides and contains 
instructions for installing and using the new features 
in pcAnywhere 10.5. 

This guide contains the following topics: 

■ What's new in this version 

■ Where to find more information 

■ Installing Symantec pcAnywhere 

■ Running pcAnywhere on Windows XP 

■ Seeing who is connected to the host 

■ Turning off watermarks 

■ Assessing host security 

■ Creating a rebootless host package 

■ Setting up Windows NT authentication for 
global users 

Consult the Symantec pcAnywhere User's Guide, 
online Help, or the Symantec pcAnywhere 
Administrator's Guide for information on topics not 
covered in this guide. 



What's new in this version 

pcAnywhere includes the following new features 
and administrator tools, designed to increase 
security, optimize performance, and make the 
software easier to use and customize. 

■ XP compatibility 

pcAnywhere is certified as meeting the 
requirements for the Designed for Microsoft 
Windows XP logo and runs on all Microsoft 32- 
bit platforms. 

■ Enhanced logging 

pcAnywhere now supports logging of the 
following types of security events: connection 
failures due to an invalid IP address or security 
ID, scans of the pcAnywhere port, Remote 
Access Perimeter Scanner (RAPS) scans, and 
host authentication warnings due to weak 
passwords for pcAnywhere callers. 

The Symantec pcAnywhere User's Guide and the 
online Help contain more information about 
logging. 

■ Host Assessment Tool 

This tool lets you check the configuration of 
your host connection items to ensure that you 
are taking advantage of the security features in 
pcAnywhere and help you identify areas where 
you might be at risk. 

See "Assessing host security" on page 5. 

■ Ability to see who is connected to the host 

Host users can see information about who is 
connected to the host, such as the remote 
computer name and the duration of the session. 

See "Seeing who is connected to the host" on 
page 5. 

■ Ability to turn off watermarks 

The View menu includes an option to show or 
hide the watermarks in the pcAnywhere 
Manager window. 

See "Turning off watermarks" on page 5. 

■ Rebootless host installation packages 

pcAnywhere Packager lets administrators create 
host-only packages that do not require end 



users to restart their computers once the 
installation is complete. 

See "Creating a rebootless host package" on 
page 8. 

■ Ability to set up Windows NT caller accounts 
for global users 

pcAnywhere lets you configure a Windows NT 
authentication caller account that supports 
global domain groups that are nested within a 
local group. 

See "Setting up Windows NT authentication for 
global users" on page 9- 

■ Ability to reset the pcAnywhere port number 
below 1024 

pcAnywhere lets you choose a port number 
lower than 1024 if your network environment 
does not support higher port numbers. 

Where to find more information 

In addition to the technical support options, 
pcAnywhere includes features designed to assist 
you in using the software. You can access some of 
these features, like the online Help and software 
wizards, while running pcAnywhere; however, 
some features are available only on the Symantec 
pcAnywhere CD. 

Information on the pcAnywhere CD 

These documents are available on the installation 
CD in PDF format: 

■ Symantec pcAnywhere Administrator's Guide 

■ Symantec pcAnywhere User's Guide 

■ Symantec pcAnywhere OLE Automation Guide 

Information on the Symantec Web site 

Check the Symantec Web site (www.symantec.com/ 
pcanywhere) for answers to frequently asked 
questions, troubleshooting tips, online tutorials, and 
the latest product information. 



2 



Installing Symantec pcAnywhere 

Consult the Symantec pcAnywhere User's Guide for 
the following information: 

■ Installation procedures 

■ Getting started 

■ Safeguarding your computer and sessions 

■ Customizing settings 

The installation CD contains additional software 
tools to assist administrators in customizing, 
managing, and securing pcAnywhere. These tools 
must be installed separately. 

For more information, see the Symantec 
pcAnywhere Administrator's Guide. 



Note: You must have administrator rights to install 
the full version of pcAnywhere on Windows NT/ 
2000/XP. During the installation process, you must 
restart the computer for the settings to take effect. 
After restarting the computer, you must log on again 
as an administrator or as a user with administrator 
rights to ensure proper functionality. 



Preparing for installation 

Before installing pcAnywhere, ensure that your 
computer meets the system requirements. Review 
the Readme file on the installation CD for any last- 
minute changes. 

System requirements 

pcAnywhere runs on Windows 9x/Millennium 
Edition (Me)/NT/2000/XP and requires, at a 
minimum, the following resources to function 
properly. Note that some of these resources are 
operating system requirements. 

Windows XP Home Edition/Professional 

■ Intel Pentium 233 MHz or higher processor 

■ 64 MB RAM (128 MB recommended) 

■ 1.5 GB available hard disk space 

■ Super VGA or higher resolution monitor 

■ CD-ROM or DVD-ROM drive 



Windows 2000 Professional/Server 

■ Intel Pentium 133 MHz or higher processor 

■ 64 MB RAM 

■ 30 MB available hard disk space 

■ VGA or higher resolution monitor 

■ CD-ROM drive 
Windows Millennium Edition 

■ Intel Pentium 150 MHz or higher processor 

■ 32 MB RAM 

■ 30 MB available hard disk space 

■ VGA or higher resolution monitor 

■ CD-ROM drive 

Windows NT 4/NT 4 Server/98/95 

■ Intel Pentium or higher processor 

■ 16 MB RAM (32 MB recommended) 

■ 30 MB available hard disk space 

■ VGA or higher resolution monitor 

■ CD-ROM drive 

If you have a previous version installed 

You must uninstall previous versions of 
pcAnywhere before installing this version. 
pcAnywhere does this automatically during the 
installation process. 

Before removing the previous version, pcAnywhere 
confirms whether you want to preserve existing 
configuration data. This data includes host and 
remote connection items, registry settings, option 
sets, and package definitions. 



Note: Because of the enhanced security features in 
pcAnywhere, only the caller properties from version 
10.0 and above can be preserved. If upgrading from 
version 9.x or lower, existing caller properties are 
no longer valid and must be reconfigured. 
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To preserve configuration settings 

1 Insert the Symantec pcAnywhere CD into the 
CD-ROM drive. 

2 In the pcAnywhere installation window, click 
Install pcAnywhere 10.5 

3 In the installation options window, select the 
type of installation that you want to perform. 

For more information, see the Symantec 
pcAnywhere User's Guide. 

4 In the Previous Version Installed window, click 
Yes 

5 Restart your computer. 

6 Install pcAnywhere. 

For more information, see the Symantec 
pcAnywhere User's Guide. 

Opening pcAnywhere after installation 

Symantec pcAnywhere is installed in the Windows 
Program Files directory and is listed on the 
Windows Start menu. 

Before you can use pcAnywhere to connect to 
another computer, transfer files, or let another 
computer connect to your computer, you must first 
provide the information needed to make a 
connection and start or end a session. This 
information is saved in the host and remote 
connection items, which appear as icons in the 
pcAnywhere Manager window. 

For more information, see the Symantec 
pcAnywhere User's Guide. 

To open Symantec pcAnywhere 

■ On the Windows taskbar, click Start > 
Programs > Symantec pcAnywhere. 

pcAnywhere opens, displaying the pcAnywhere 
Manager window. 



Running pcAnywhere on 
Windows XP 

For optimal performance, log on as a user with 
administrator rights when running pcAnywhere on 
Windows XP. 

Differences between administrator and 
limited users 

Windows XP restricts users who are assigned to 
limited user or guest accounts from installing or 
uninstalling software, changing system- wide 
settings, or adding, editing, or deleting user 
accounts. 

The following table explains which actions in 
pcAnywhere can be performed by users with 
administrator or limited user rights. 



Action 


Administrator 
rights 


Limited user 
rights 


Install 

pcAnywhere 


Yes 


No 


Install 

pcAnywhere 
packages 


Yes 


No 


Start a host 
session 


Yes 


Yes, if the host 
is not 

configured to 
run as a service 


Start a host 
session as a 
service 


Yes 


No, unless a 
user with 
administrator 
rights logs on to 
the computer 
and starts the 
session 


Control another 

computer 

remotely 


Yes 


Yes 


Transfer, 
synchronize, or 
clone files 


Yes, if the user 
has permission 
to access the 
directory 


Yes, if the user 
has permission 
to access the 
directory 
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Action 



Administrator 
rights 



Limited user 
rights 



Configure and Yes 
build packages 



Configure a host Yes 
connection item 

Configure a caller Yes 
account 

Configure logging Yes 
events 



Yes; however, 
user cannot 
install the 
package 

Yes 



Yes 



No 



Disabling Fast User Switching 

Windows XP Fast User Switching lets multiple users 
log on to a computer simultaneously without 
closing programs that are running. This option is 
enabled by default in some versions of Windows 
XP, but is not available for Windows XP 
Professional-based computers that are part of a 
domain network. 

Because switching users during a pcAnywhere 
session can interfere with operations, the 
pcAnywhere installation process disables Fast User 
Switching. You can still access the Windows 
Welcome screen, but the option to change how 
users log on is not available. To restore Fast User 
Switching, you must uninstall pcAnywhere. 

Seeing who is connected to the 
host 

During a session, you can see information about 
who is connected to the host computer. This 
information includes: 

■ Duration of session 

■ User name 

■ Type of connection (such as TCP/IP) and the 
device name 

For example, for TCP/IP connections, 
pcAnywhere provides the remote computer 
name, as specified in Windows. 



To see who is connected to the host 

■ During a session, move the cursor over the host 
icon on the system tray. 

A window appears, containing information 
about the session. 



Turning off watermarks 

The watermarks in the pcAnywhere Manager 
window help you distinguish between different 
modes of operation, such as host or remote. If the 
watermarks obstruct your view of the objects in the 
pcAnywhere Manager window, such as remote 
connection items, you can turn them off. 

To turn off watermarks 

■ In the pcAnywhere Manager window, on the 
View menu, click Watermarks. 

Repeat this procedure to re-enable watermarks. 



Assessing host security 

The Host Assessment Tool lets you check the 
configuration of your host connection items to 
ensure that you are taking advantage of the security 
features in pcAnywhere and help you identify areas 
where you might be at risk. 

The Host Assessment Tool only checks for the 
security settings that are supported by your 
computer configuration. For example, some video 
cards do not support the screen blanking feature. If 
the Host Assessment Tool detects that your 
computer is not configured to support a specific 
security feature, that feature is not included in the 
scan. 

The Host Assessment Tool is only available in the 
full product installation and customized installation 
packages that include pcAnywhere Manager. 
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The Host Assessment Tool window 



Host Assessment Tool 



2<l 



pcAnywhere 

Host Assessment Tool 



^ Symantec- 



The Host Assessment Tool helps you evaluate security settings associated with host connection items. Use the information 
below to evaluate whether you need to adjust host security settings. 

Scan Results 



DIRECT 
MODEM 



NETWORK. CABLE, DSL 



_ 

Browse... 



A Encryption is not enabled 

O Option to confirm a remote connection is not enabled 

Lock NT Workstation option is not enabled 

Host waits for other connections if session ends abnormally 
O Host waits for other connections if session ends normally 

Number of allowed logon attempts limited to 3 or fewer 
© Time allowed to complete logon is 3 minutes or less 



J ±J 



Encryption protects the session, including the authorization process, from 
eavesdropping and hacker attacks. 



Although pcAnywhere encryption offers some protection, it is not as 
effective as public-key or symmetric encryption. 



Export.. 



Number Description 



Displays the names of the host connection items that are located in the 
pcAnywhere data directory 



Lets you specify another location for the host connection items C-bhf files) 

Provides more information about ways to secure pcAnywhere 

Lets you save the scan results in a text, comma-delimited file 

Provides more information about the security setting that is selected in the 
Scan Results list 

Lists the security settings that were checked during the scan along with status 
indicators 
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Running the Host Assessment Tool 

The Host Assessment Tool scans the configuration 
settings in a selected host connection item and 
provides information to help you secure 
pcAnywhere. 

When you open the Host Assessment Tool, the 
main window lists the names of the host connection 
items that are located in the pcAnywhere data 
directory. 

If you moved the host connection items (.bhf files) 
to another directory, no host names are listed. You 
must specify the new location of the host 
connection items before running a scan. 

See "Specifying the location of the host connection 
items" on page 7. 

To run the Host Assessment Tool 

1 In the pcAnywhere Manager window, click 
Hosts. 

2 On the Tools menu, click Host Assessment 
Tool 

3 In the Host List, select the host connection item 
that you want to scan. 

After you select an item in the host list, the scan 
results automatically appear in the Scan Results 
list. 

See "Analyzing the scan results" on page 7. 



Note: The Host Assessment Tool prompts you for a 
password if the selected host connection item 
requires a password to view properties. 



Specifying the location of the host 
connection items 

By default, the Host Assessment Tool looks for the 
host connection items (.bhf files) in the 
pcAnywhere data directory. If you moved the host 
connection items to another directory, you must 
specify the new location before running a scan. 



To specify the location of the host connection 
items 

1 In the pcAnywhere Manager window, click 
Hosts. 

2 On the Tools menu, click Host Assessment 
Tool 

3 In the Host Assessment Tool window, click 
Browse. 

4 Select the folder that contains the host 
connection items. 

5 Click OK. 

Analyzing the scan results 

After you ran the Host Assessment Tool, the security 
settings that were checked are listed in the Scan 
Results box. Beside each item is an indicator, which 
helps you identify areas for improvement as well as 
areas that are more secure. 

The following table explains what each indicator 
means. 



Indicator 


Explanation 


Red triangle 


Signifies an area of concern. This 




security setting is not in use or is not 




configured as securely as it could be. 


Yellow 


Spotlights a security feature that is 


diamond 


not in use, but worth considering. 




This indicator is intended to increase 




awareness. Some features might not 




be appropriate for your environment. 


Green circle 


Signifies that a security setting is 




enabled. 



The color-coded indicators provide a visual cue 
about whether you are taking advantage of the 
security features in pcAnywhere. As you review the 
results, be aware that having more of one indicator 
than another does not necessarily mean that the 
host configuration is secure or not secure. 

Some security settings might not be appropriate for 
your environment. For example, the Host 
Assessment Tool checks for caller accounts that 
have superuser rights, and if found, identifies the 
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caller with a red indicator. In most cases, you 
should limit the level of access that a remote user 
has to your computer. However, if the caller 
account is for yourself or another trusted user, it 
might be appropriate to allow more access rights. 

The Detailed box provides more information about 
the security implications of a specific setting. 

To see more detailed results 

■ In the Scan Results list, select the entry about 
which you want to learn more. 

The Host Assessment Tool also includes online Help 
so that you can learn more about ways to secure 
pcAnywhere. 

See "Learning more about security" on page 8. 
You can also save the results of a scan in a text file. 
See "Saving scan results" on page 8. 

Learning more about security 

The Host Assessment Tool provides information on 
ways to secure pcAnywhere, including important 
factors to consider when choosing an option. 

To learn more about pcAnywhere security 
features 

1 In the pcAnywhere Manager window, click 
Hosts. 

2 On the Tools menu, click Host Assessment 
Tool 

3 In the Host Assessment Tool window, click 
Learn More. 

Saving scan results 

The Host Assessment Tool lets you save the results 
of the scan in a text file (in comma delimited [CSV] 
format). This file can be sent to an administrator as 
a configuration or security monitoring tool or used 
as a reference for configuring other host connection 
items. 



To save scan results 

1 In the Host Assessment Tool window, click 
Export. 

2 Specify the location in which you want to save 
the file. 

3 Type a file name. 

4 Click OK. 

Creating a rebootless host 
package 

pcAnywhere Packager lets administrators create 
customized installation packages, which can be 
distributed to licensed users. A new feature in 
pcAnywhere Packager is the ability to create a 
package with basic, host-only functionality that 
does not require end users to restart their 
computers once the installation is complete. For 
example, a help desk administrator can create a 
rebootless host package and deploy it over the Web 
to a licensed user who needs assistance. The user 
then installs the package and starts a host session 
without having to restart the computer or log off 
from the network. 

You have three options for creating and building a 
rebootless host package: 

■ Use the Rebootless Host preconfigured package 
contained in pcAnywhere. 

■ Create a new rebootless host package. 

■ Copy an existing rebootless host package. 

Because of the complexities involved in configuring 
a rebootless host, you should start with the 
preconfigured, Rebootless Host package. 

Design considerations 

By design, rebootless host packages have limited 
functionality to maintain a smaller footprint and 
ensure that the client computer does not require a 
restart. If the package includes platform-specific 
components or components that require an update 
to the operating system, a restart might be required. 
This behavior is a constraint of the operating 
system. 
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The following features are not supported in 
rebootless host packages: 

■ Remote control or file transfer functionality 

■ pcAnywhere Manager 

■ Accelerated video mode 

■ Screen scaling 

■ Ability to blank host screen 

■ Window tracking 

■ Full screen DOS mode 

■ Centralized event logging 

■ Windows 9x drive security 

■ Remote printing 

■ Ability to lock NT workstation (on Windows NT 
4.0 only) 

The pcAnywhere Packager Components tab 
provides additional information about rebootless 
host requirements. 

To view rebootless host requirements 

1 In the pcAnywhere Manager window, click 
Packages. 

2 Double-click the Rebootless Host preconfigured 
package. 

3 On the Components tab, expand the Host 
components list. 

4 Click Rebootless Host. 

Rebootless host requirements appear in the 
Component description box. 

Required components 

Rebootless host packages must include the 
following components so that users can launch a 
host session once the package is installed. 

■ A host object that includes a caller account 

pcAnywhere requires a user ID and password 
for all host sessions to protect the host from 
unauthorized access. 



■ A desktop shortcut to the host object 

Rebootless host packages cannot include 
pcAnywhere Manager because of operating 
system dependencies that would require the 
user to restart the computer. 

Client system requirements 

Rebootless host packages require certain shared 
Microsoft operating system files, which must already 
be installed on the client computer. Because some 
of these files require a restart, they are not included 
in the rebootless host package. These files are not 
included in Windows 9x/NT/2000, unless they were 
previously installed by other applications (such as 
Microsoft Office 2000). Rebootless host is fully 
supported on Windows Me/XR 

The client computer on which the rebootless host 
package is installed must meet the following system 
requirements: 

Windows Me/2000/XP 

■ Internet Explorer 5.0 or later 

Windows 9x/NT 4 

■ Core Microsoft operating system files 

■ Internet Explorer 5.0 or later 

Preparing the package 

The Symantec pcAnywhere Administrator's Guide 
and online Help contain instructions for 
configuring, building, and deploying custom 
installation packages. 

Setting up Windows NT 
authentication for global users 

pcAnywhere lets you configure a server using NT 
authentication to support callers from the local 
administrator user group as well as any global 
groups that are included in the local group. 

Using this feature, you can set up a caller account 
on a server for all administrators in your company 
by adding a domain account to the local 
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administrator group instead of having to add an 
individual account for each administrator to the 
local administrator group. 

This feature is supported only for Windows NT 
authentication. 

To set up Windows NT authentication for 
global users 

1 In the pcAnywhere Manager window, click 
Hosts. 

2 Do one of the following: 

■ Double-click Add Host to add a new host 
connection item. 

■ Right-click a connection item, then click 
Properties to modify an existing 
connection item. 

3 On the Callers tab, under Authentication type, 
click NT. 

4 Do one of the following: 

■ In the Caller list pane, right-click, then click 
New to add a new caller. 

■ In the Caller list, double-click a name to 
modify an existing caller. 

5 In the Caller Properties dialog box, on the 
Identification tab, check Support Global NT 
users and groups defined in Local NT 
groups. 

6 Click OK. 
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